Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin CSRF vulnerability and missing permission checks

2022-05-1301:50:55

Google

osv.dev

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.

CPENameOperatorVersion
org.jenkins-ci.plugins:maven-artifact-choicelistprovidereq1.2.4
org.jenkins-ci.plugins:maven-artifact-choicelistprovidereq1.0.4
org.jenkins-ci.plugins:maven-artifact-choicelistprovidereq1.0.5
org.jenkins-ci.plugins:maven-artifact-choicelistprovidereq1.0.3
org.jenkins-ci.plugins:maven-artifact-choicelistprovidereq1.1.2
org.jenkins-ci.plugins:maven-artifact-choicelistprovidereq1.3.0
org.jenkins-ci.plugins:maven-artifact-choicelistprovidereq1.2.2
org.jenkins-ci.plugins:maven-artifact-choicelistprovidereq1.1.0
org.jenkins-ci.plugins:maven-artifact-choicelistprovidereq1.2.0
org.jenkins-ci.plugins:maven-artifact-choicelistprovidereq1.1.3

Name	Operator	Version
org.jenkins-ci.plugins:maven-artifact-choicelistprovider	eq	1.2.4
org.jenkins-ci.plugins:maven-artifact-choicelistprovider	eq	1.0.4
org.jenkins-ci.plugins:maven-artifact-choicelistprovider	eq	1.0.5
org.jenkins-ci.plugins:maven-artifact-choicelistprovider	eq	1.0.3
org.jenkins-ci.plugins:maven-artifact-choicelistprovider	eq	1.1.2
org.jenkins-ci.plugins:maven-artifact-choicelistprovider	eq	1.3.0
org.jenkins-ci.plugins:maven-artifact-choicelistprovider	eq	1.2.2
org.jenkins-ci.plugins:maven-artifact-choicelistprovider	eq	1.1.0
org.jenkins-ci.plugins:maven-artifact-choicelistprovider	eq	1.2.0
org.jenkins-ci.plugins:maven-artifact-choicelistprovider	eq	1.1.3